persónuverndarlögum

Persónuverndarlög are Icelandic laws governing the processing of personal data and the protection of privacy. In Iceland, these laws implement and align with the EU General Data Protection Regulation (GDPR) through national legislation, reflecting Iceland’s status in the European Economic Area. The rules apply to both public authorities and private entities that handle personal data, and the oversight body is the Data Protection Authority, known as Persónuvernd.

The legislation rests on core principles: processing must be lawful, fair and transparent; data is collected for specified, explicit purposes; data minimization and accuracy are required; storage should be limited; and security measures must be in place. Organisations must be able to demonstrate accountability, maintain records of processing, and conduct impact assessments for high-risk activities. In certain cases, a data protection officer may be required.

Data subjects have a set of rights under the laws, including access to their data, rectification, erasure (the right to be forgotten), restrictions on processing, data portability, and objection to processing in certain circumstances. The laws specify valid grounds for processing, such as consent, performance of a contract, compliance with a legal obligation, legitimate interests, or the protection of vital interests. Special categories of data receive enhanced protection, and the processing of children’s data is given particular emphasis.

Enforcement and remedies include obligations to report data breaches to Persónuvernd promptly (and to inform affected individuals when there is a high risk to rights). Cross-border data transfers require appropriate safeguards. Non-compliance can lead to investigations, corrective orders, and financial penalties. Persónuvernd issues guidance and decisions to promote compliance across public and private sectors.